[Proofpoint TAP] Trailing slash in API URL causes double-slash and 400 Bad Request #18984

Description

When configuring the Proofpoint TAP agentless integration, if the user enters a trailing / at the end of the API URL in the integration UI, the integration constructs a malformed URL with a double-slash (//). This results in a 400 Bad Request from the Proofpoint API with the message "Ambiguous URI empty segment", and no data is collected.

Steps to Reproduce

1. Configure the Proofpoint TAP integration (Agentless)
2. In the API URL field, enter the URL with a trailing slash, e.g. https://tap-api-v2.proofpoint.com/
3. Save and run the integration

Observed Behaviour

The integration constructs a double-slash URL:

https://tap-api-v2.proofpoint.com//v2/siem/messages/delivered?format=json&interval=...

The Proofpoint API returns a 400 error:

{
  "message": "Ambiguous URI empty segment",
  "url": "https://tap-api-v2.proofpoint.com//v2/siem/messages/delivered?...",
  "status": "400"
}

Full error seen in logs:

failed to collect first response: failed to execute http GET: server responded with status code 400 Bad Request: { "message":"Ambiguous URI empty segment", "url":"https://tap-api-v2.proofpoint.com//v2/siem/messages/delivered?format=json&interval=2026-05-07T12%3A44%3A38Z%2F2026-05-07T13%3A44%3A38Z", "status":"400" }

Expected Behaviour

The integration should either strip any trailing slash from the URL before constructing the request, or validate the input in the UI and show an error/warning if a trailing slash is present.

Integration UI Guidance

The URL field in the integration UI should include helper text clarifying the expected format, e.g.:

API URL
Enter the base URL without a trailing slash.
✅ Correct: https://tap-api-v2.proofpoint.com
❌ Incorrect: https://tap-api-v2.proofpoint.com/

Fix Recommendations

• Trim trailing slashes from the URL value before constructing API requests (defensive, handles existing misconfigured integrations)
• Add UI-level validation or hint text so users know not to include a trailing slash

Customer Impact

Integration silently fails to collect any data — the only indication is a 400 error in logs.